Skip to main content
MalwarePublished

Uncovering a SectopRAT Variant Embedded in Legitimate Software

Source AlienVault OTX General

0

Description

SectopRAT (also known as ArechClient2) is a .NET-based remote access trojan (RAT) that provides a range of functions through multiple control commands. These include collecting sensitive data from the victim’s device, capturing screens, remotely managing processes and files, controlling bots, and other forms of remote device management.

Indicators of compromise

Domains 8

  • bsc-dataseed1.ninicoin.io
  • bsc-dataseed4.ninicoin.io
  • bsc-dataseed3.defibit.io
  • bsc-dataseed4.defibit.io
  • bsc-dataseed3.ninicoin.io
  • bsc-dataseed2.ninicoin.io
  • bsc-dataseed2.defibit.io
  • bsc-dataseed1.defibit.io

URLs 10

  • http://98.142.252.140:15847
  • http://98.142.252.140:9000/wmglb
  • https://bsc-dataseed1.defibit.io/
  • https://bsc-dataseed1.ninicoin.io/
  • https://bsc-dataseed2.defibit.io/
  • https://bsc-dataseed2.ninicoin.io/
  • https://bsc-dataseed3.defibit.io/
  • https://bsc-dataseed3.ninicoin.io/
  • https://bsc-dataseed4.defibit.io/
  • https://bsc-dataseed4.ninicoin.io/

Hashes 5

  • a12ba3a3dcd70e02f89253c9ec78b11f
  • 37fcbcb21d16866784050682c58424c91d3a736f6fd599271fa6e53cf5ca8a92
  • 48d3ecbb9e0b6babe6e53e2082a076bad07ef61ccd98dcc8b9e4f390b937788b
  • 95f6abd3c43ef4b33cd61d054527233dd2ce705804d44a04be96cfb73bb52e3a
  • efa07701570983909ef923ea79bb032f19fd9dac0b819fa0e4f6b1161a4cc221

Community reviews

Loading reviews…